9 Commits

Include renames

Author	SHA1	Message	Date
Bot	4f4c5a467b	traefik: add cron wrapper for coordinated multi-node log rotation ... reverse-proxy runs Swarm mode:global (one instance per node), all writing to the same CephFS file. This wrapper uses a shared flock + shared logrotate state file (both also on the CephFS mount) so cron on docker-1/2/3 can run independently without racing or double-rotating.	2026-09-11 23:29:00 -07:00
Bot	e27d2f6ac2	traefik: add logrotate config for access/traefik logs ... Traefik has no built-in log rotation and no SIGUSR1/reopen handling. --accesslog.filePath and --log.filePath (traefik.yaml) write directly to /volume1/docker/traefik/logs, which had grown to 15.5GB unrotated, contributing to disk pressure (docker-2 CephFS at 82%) and adding write latency to every request through Traefik.	2026-09-11 23:29:00 -07:00
Bot	5ab1ae1e8b	chore(traefik): re-trigger provision-secrets — traefik.env was found missing on disk post-migration ... traefik/traefik.env did not exist on the host after PR #21 merged. Root cause: provisioning only renders on a push touching traefik/, and traefik is bootstrap-tier (stack-deploy.sh runs manually, never via the pipeline). A manual stack-deploy.sh traefik run apparently happened while the env file was absent, causing Swarm's own interpolation to render KEEPALIVED_PASSWORD/KEEPALIVED_VIRTUAL_IPS as empty strings on keepalived-master. This comment-only change re-triggers provision-secrets; a manual stack-deploy.sh traefik run is still required afterward to apply the freshly-rendered env to the running services.	2026-09-11 23:17:13 -07:00
Bot	5edebd977d	fix(traefik): remove tracked traefik.env — never commit secret-bearing env files ... The committed version contained a literal "***REDACTED***" placeholder as KEEPALIVED_PASSWORD, which was restored onto disk every time the real file was deleted or the local checkout re-synced from git. This caused VRRP auth to mismatch between keepalived-master and keepalived-backup (master picked up the broken committed value, backup retained a stale-but-correct value), producing a continuous "(VI_1) received an invalid passwd!" flood and VIP instability. traefik.env is now rendered fresh from traefik.env.template by deploy/provision-stack.py on every provisioning run and never committed.	2026-09-11 22:38:39 -07:00
Bot	ffec3ea5b7	feat(traefik): add authoritative env template for manifest-driven provisioning	2026-09-11 22:38:38 -07:00
admin	44babb6a22	Fix YAML alias-scanner crash: quote KEEPALIVED_PASSWORD/KEEPALIVED_VIRTUAL_IPS env values ... mount-guard.py failed with "expected alphabetic or numeric character, but found '*'" during rendering. Root cause: KEEPALIVED_PASSWORD and KEEPALIVED_VIRTUAL_IPS were interpolated unquoted; when the live secret value happens to start with '*', YAML's scanner parses it as an alias reference (*anchor) instead of literal text. KEEPALIVED_UNICAST_PEERS on the adjacent line was already quoted for the same reason (starts with '#') - this brings the other two env values in line with that existing convention. Also noted (not fixed here): live traefik-certs-dumper service is running v2.10.0 while this file already pins v2.11.4 - redeploy needed separately to pick that up.	2026-08-29 14:03:36 -07:00
AVB	10c35138db	Bump traefik-certs-dumper:v2.10.0 to 2.11.4	2026-08-29 13:56:35 -07:00
admin	c2069e3e0d	feat(traefik): migrate to folder-based stack layout	2026-07-25 22:19:26 -07:00
admin	6caa7f0a33	feat(traefik): migrate to folder-based stack layout	2026-07-25 22:19:25 -07:00